The question moved upstairs
The board asked about security, and “IT handles it” did not land.
A director asked what your exposure is.
Board answer / 02
The board asked about security
Board signal
“IT handles it” stopped landing. Someone has to own the answer.
Recommended service
Virtual CISO leadershipContext behind the pressure
An investor added security to the agenda. Or leadership simply noticed that no one could say, in one page, where the company stands. The work happening in IT may be real—but there is no owner, no baseline, and no report a non-technical board can interrogate. The next meeting is already on the calendar.
You are likely here if
The pressure is specific. The answer is not yet.
- 01
Security spend shows up in the budget, but nobody can connect it to a list of the risks it is supposed to reduce.
- 02
The honest answer to “who owns security?” is a person with another full-time job.
- 03
The last security update was a tool inventory—and the board’s follow-up questions ended the slide.
The decision on the table
Name the decision before choosing the deliverable. It keeps the work tied to the business question that created the pressure.
Before hiring anyone or buying anything, decide what the board should be told and by whom. Three options are usually live: a full-time executive hire, better reporting with ownership left in IT, or fractional senior ownership. The wrong move is answering a governance question with a tooling purchase. The board is asking for an accountable answer.
Ackatec’s working view
A position before a proposal.
- 01
Boards want a position, not reassurance.
A defensible position names material exposure, what leadership has decided to accept, fix, or transfer, and who owns each call.
- 02
A full-time hire can be the right answer and the wrong first move.
Hired before a baseline and mandate exist, a security leader begins by building the case the board wanted to see in the first meeting.
- 03
Cadence beats polish.
One page, every quarter, in the same structure lets the second briefing show movement against the first instead of restarting the conversation.
A representative first artifact
First board briefing
The two-page working outline a board can actually interrogate.
Working structure
- 01
Position
The risks material to this business, each marked accepted, being fixed, transferred, or undecided.
- 02
Obligations
What customers, insurers, and regulators currently require, and where the company stands against each.
- 03
Ownership
Who decides what, by name, and which decisions escalate to leadership.
- 04
Movement
The three commitments for next quarter, each with an owner and a date.
- 05
Asks
The decisions the board itself must make about risk appetite, budget, or hiring.
Deliberately short. If the briefing cannot fit on two pages, the program has a prioritization problem, not a reporting problem.
This is Ackatec’s working structure for the situation—shaped to each organization in the first sessions, not a sample of past client work.
Recommended next step
Get the right help for this moment.
Begin from the situation